1. Comments Presentation for Part11 FDA Public Meeting Docket # 2004N-0133 Venue and Date: 429 L'Enfant Plaza, SW Washington, DC 20594 June 11, 2004

2. Presentation by: Sanjeev Kumar Manager, Computer System Validation Compliance Apotex Inc. 150 Signet Drive Weston, Ontario M9L 1T9 Telephone: (416) 675-8421

3. Discussion Points Comments on: Narrow interpretation of Part11 Legacy Systems Should Part11 address Record Conversion Risk Based Approaches Audit Trail requirements Role of QA

4. Narrow Interpretation of Part11 Comments: –Has provided more flexibility; –Has encouraged innovation; –Makes sense as validation extent can be derivative of the Risk Assessment; –General industry can utilize latest PAT driven technologies for better process development and for BETTER PRODUCT;

5. Narrow Interpretation of Part11 Comments: –Legacy systems being out of scope makes remediation efforts less daunting and less money intensive; –Risk assessment on the e-records level has made records archiving more sensible and logical. THANKS TO THE AGENCY FOR ALL THIS

6. Legacy Systems Comments: –SYSTEM More clarity required on what FDA expects on Legacy Systems that have been upgraded; What level of system upgrade transitions Legacy to non-Legacy Systems; What Remediation Efforts are expected from the industry for non-Legacy systems; –RECORDS Records archiving of the e-records generated by Legacy systems that are still in use.

7. Should Part11 Address Records Conversion Comments: E-Records –Short Answer is: YES –And the Long one is : Following should be addressed as part of above subject: –What data should be archived or converted ; Raw or Processed; –If RAW DATA then does META DATA also needs to be there; –Does FDA expect industry to maintain obsolete technology to convert Raw data into processed results at the time of inspection / Audit. –Agency should recommend the risk assessment model for determining the rationale for records storage.

8. Should Part11 Address Records Conversion Comments: Paper Records –FDA should provide guidance on converting paper records in to e-records; examples: Qualification protocols can be scanned and pdf’ed for long time storage; will these records be acceptable to FDA during the audits as original paper documents will not be available.

9. RISK ASSESSMENT Comments: –Agency should provide examples of risk assessment models thus sharing their expectations; –Clear direction on the basis of Risk Assessment that is; risk assessment should be based on system complexity or system’s risk to the business. A very simple system can be of very high risk value to GxP business.

10. Audit Trail Requirements Comments: –The new rule should clearly indicate for what specific actions audit trail is mandatory for instance: Is audit trail required for system’s administrator’s actions such as user profile administration; Or just the operator/ user level actions should be logged; – If possible is procedurilzed audit trail log (may be manual) accepted;

11. Audit Trail Requirements Comments: –Audit trail requirements should include safeguards designed and implemented to: Deter unauthorized records creation; Prevent unauthorized modifications of records; Prevent deletion of unauthorized records; –Agency should clearly state their expectation on: Is it mandatory for the system to have ability to generate audit trails. (Computer generated) –Can agency clarify the difference between the predicate rule requirement of Audit Trail and 11.10(e) requirements.

12. Role of QA Comments: –FDA through Part11 or predicate rules should provide direction on: Does FDA expect QA’s role as providing: –Independent meaningful assessment of qualification work; –Defend systems during audits; What training level, qualifications or experience should a QA have to : –Provide meaningful qualification document review; –Conduct vendor audits; –Defend systems validation;

13. Comments Presentation for Part11 FDA Public Meeting Docket # 2004N-0133 Thanks for the opportunity. Any Questions